Puppet Class: profile::firewall

Defined in:
modules/profile/manifests/firewall.pp

Overview

SPDX-License-Identifier: Apache-2.0

Parameters:

  • conftool_prefix (String) (defaults to: lookup('conftool_prefix')) —

    the prefix used for conftool

  • monitoring_hosts (Array[Stdlib::IP::Address]) (defaults to: lookup('monitoring_hosts')) —

    monitoring hosts

  • cumin_masters (Array[Stdlib::IP::Address]) (defaults to: lookup('cumin_masters')) —

    management hosts

  • bastion_hosts (Array[Stdlib::IP::Address]) (defaults to: lookup('bastion_hosts')) —

    bastion hosts

  • cache_hosts (Array[Stdlib::IP::Address]) (defaults to: lookup('cache_hosts')) —

    cache hosts

  • kafka_brokers_main (Array[Stdlib::IP::Address]) (defaults to: lookup('kafka_brokers_main')) —

    kfaka broker hosts

  • kafka_brokers_jumbo (Array[Stdlib::IP::Address]) (defaults to: lookup('kafka_brokers_jumbo')) —

    kfaka broker jumbo hosts

  • kafka_brokers_logging (Array[Stdlib::IP::Address]) (defaults to: lookup('kafka_brokers_logging')) —

    kfaka broker logging hosts

  • kafkamon_hosts (Array[Stdlib::IP::Address]) (defaults to: lookup('kafkamon_hosts')) —

    kafka monitoring hosts

  • zookeeper_hosts_main (Array[Stdlib::IP::Address]) (defaults to: lookup('zookeeper_hosts_main')) —

    zookeeper hosts

  • druid_public_hosts (Array[Stdlib::IP::Address]) (defaults to: lookup('druid_public_hosts')) —

    druid hosts

  • labstore_hosts (Array[Stdlib::IP::Address]) (defaults to: lookup('labstore_hosts')) —

    labstore hosts

  • mysql_root_clients (Array[Stdlib::IP::Address]) (defaults to: lookup('mysql_root_clients')) —

    mysql root client hosts

  • deployment_hosts (Array[Stdlib::IP::Address]) (defaults to: lookup('deployment_hosts')) —

    deployment hosts

  • prometheus_nodes (Array[Stdlib::Host]) (defaults to: lookup('prometheus_nodes')) —

    prometheus hosts

  • manage_nf_conntrack (Boolean) (defaults to: lookup('profile::firewall::manage_nf_conntrack')) —

    manage contract

  • enable_logging (Boolean) (defaults to: lookup('profile::firewall::enable_logging')) —

    enable logging

  • defs_from_etcd (Boolean) (defaults to: lookup('profile::firewall::defs_from_etcd')) —

    build ferm definitions from requestctl etcd data

  • defs_from_etcd_nft (Boolean) (defaults to: lookup('profile::firewall::defs_from_etcd_nft')) —

    build ferm definitions from requestctl etcd data for nftables (temporary)

  • zookeeper_flink_hosts (Array[Stdlib::IP::Address]) (defaults to: lookup('zookeeper_flink_hosts'))
  • provider (Firewall::Provider) (defaults to: lookup('profile::firewall::provider')) 


21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
 
# File 'modules/profile/manifests/firewall.pp', line 21

class profile::firewall (
    String                     $conftool_prefix         = lookup('conftool_prefix'),
    Array[Stdlib::IP::Address] $monitoring_hosts        = lookup('monitoring_hosts'),
    Array[Stdlib::IP::Address] $cumin_masters           = lookup('cumin_masters'),
    Array[Stdlib::IP::Address] $bastion_hosts           = lookup('bastion_hosts'),
    Array[Stdlib::IP::Address] $cache_hosts             = lookup('cache_hosts'),
    Array[Stdlib::IP::Address] $kafka_brokers_main      = lookup('kafka_brokers_main'),
    Array[Stdlib::IP::Address] $kafka_brokers_jumbo     = lookup('kafka_brokers_jumbo'),
    Array[Stdlib::IP::Address] $kafka_brokers_logging   = lookup('kafka_brokers_logging'),
    Array[Stdlib::IP::Address] $kafkamon_hosts          = lookup('kafkamon_hosts'),
    Array[Stdlib::IP::Address] $zookeeper_hosts_main    = lookup('zookeeper_hosts_main'),
    Array[Stdlib::IP::Address] $zookeeper_flink_hosts   = lookup('zookeeper_flink_hosts'),
    Array[Stdlib::IP::Address] $druid_public_hosts      = lookup('druid_public_hosts'),
    Array[Stdlib::IP::Address] $labstore_hosts          = lookup('labstore_hosts'),
    Array[Stdlib::IP::Address] $mysql_root_clients      = lookup('mysql_root_clients'),
    Array[Stdlib::IP::Address] $deployment_hosts        = lookup('deployment_hosts'),
    Array[Stdlib::Host]        $prometheus_nodes        = lookup('prometheus_nodes'),
    Firewall::Provider         $provider                = lookup('profile::firewall::provider'),
    Boolean                    $manage_nf_conntrack     = lookup('profile::firewall::manage_nf_conntrack'),
    Boolean                    $enable_logging          = lookup('profile::firewall::enable_logging'),
    Boolean                    $defs_from_etcd          = lookup('profile::firewall::defs_from_etcd'),
    Boolean                    $defs_from_etcd_nft      = lookup('profile::firewall::defs_from_etcd_nft'),
) {
    include network::constants
    class { 'firewall':
        provider => $provider,
    }

    if $enable_logging and $provider == 'ferm' {
        include profile::firewall::log::ferm
    }

    if $manage_nf_conntrack and !$facts['wmflib']['is_container'] {
        # Increase the size of conntrack table size (default is 65536)
        sysctl::parameters { 'ferm_conntrack':
            values => {
                'net.netfilter.nf_conntrack_max'                   => 262144,
                'net.netfilter.nf_conntrack_tcp_timeout_time_wait' => 65,
            },
        }

        # The sysctl value net.netfilter.nf_conntrack_buckets is read-only. It is configured
        # via a modprobe parameter, bump it manually for running systems
        exec { 'bump nf_conntrack hash table size':
            command => '/bin/echo 32768 > /sys/module/nf_conntrack/parameters/hashsize',
            onlyif  => "/bin/grep --invert-match --quiet '^32768$' /sys/module/nf_conntrack/parameters/hashsize",
        }
    }

    firewall::service { 'ssh-from-bastion':
        proto  => 'tcp',
        port   => 22,
        srange => $bastion_hosts,
    }

    firewall::service { 'ssh-from-cumin-masters':
        proto    => 'tcp',
        port     => 22,
        src_sets => ['CUMIN_MASTERS'],
    }

    $all_monitoring_hosts = $prometheus_nodes + $monitoring_hosts
    unless $all_monitoring_hosts.empty() {
        ['udp', 'tcp'].each |$proto| {
            firewall::service { "full-monitoring-metrics-access-${proto}":
                proto      => $proto,
                port_range => [1,65535],
                srange     => $all_monitoring_hosts,
            }
        }
    }

    ensure_packages('conntrack')

    if $defs_from_etcd {
        confd::file { '/etc/ferm/conf.d/00_defs_requestctl':
            ensure          => stdlib::ensure($provider == 'ferm'),
            reload          => '/bin/systemctl reload ferm',
            watch_keys      => ['/request-ipblocks/abuse'],
            content         => file('profile/firewall/defs_requestctl.tpl'),
            prefix          => $conftool_prefix,
            relative_prefix => false,
        }
    }

    case $provider {
        'ferm': {
            if $defs_from_etcd {
                # unmanaged files under /etc/ferm/conf.d are purged
                # so we define the file to stop it being deleted
                file { '/etc/ferm/conf.d/00_defs_requestctl':
                    ensure => file,
                }
                ferm::rule { 'drop-blocked-nets':
                    prio => '01',
                    rule => 'saddr $BLOCKED_NETS DROP;',
                    desc => 'drop abuse/blocked_nets.yaml defined in the requestctl private repo',
                }
            }
            ferm::conf { 'main':
                prio   => '02',
                source => 'puppet:///modules/base/firewall/main-input-default-drop.conf',
            }

            ferm::conf { 'defs':
                prio    => '00',
                content => template('base/firewall/defs.erb'),
            }

            nrpe::plugin { 'check_conntrack':
                source => 'puppet:///modules/base/firewall/check_conntrack.py',
            }

            nrpe::monitor_service { 'conntrack_table_size':
                description   => 'Check size of conntrack table',
                nrpe_command  => '/usr/local/lib/nagios/plugins/check_conntrack 80 90',
                contact_group => 'admins',
                notes_url     => 'https://wikitech.wikimedia.org/wiki/Monitoring/check_conntrack',
            }

            nrpe::plugin { 'check_ferm':
                source => 'puppet:///modules/base/firewall/check_ferm',
            }

            nrpe::monitor_service { 'ferm_active':
                description    => 'Check whether ferm is active by checking the default input chain',
                nrpe_command   => '/usr/local/lib/nagios/plugins/check_ferm',
                sudo_user      => 'root',
                contact_group  => 'admins',
                notes_url      => 'https://wikitech.wikimedia.org/wiki/Monitoring/check_ferm',
                check_interval => 30,
            }
        }

        'nftables': {
            include profile::firewall::nftables_base_sets

            # The following priorities apply:
            # < 100 - Anything which should precede the base firewall
            # 100   - The base firewall definition
            # > 100 - Freely available for changes which come after the base setup
            nftables::file { 'base':
                order   => 100,
                content => file('profile/firewall/base.nft'),
            }

            if $defs_from_etcd and $defs_from_etcd_nft {
                confd::file { '/etc/nftables/sets/requestctl.nft':
                    reload          => '/bin/systemctl reload nftables',
                    watch_keys      => ['/request-ipblocks/abuse'],
                    content         => file('profile/firewall/defs_requestctl_nftables.tpl'),
                    prefix          => $conftool_prefix,
                    relative_prefix => false,
                }

                # unmanaged files under /etc/nftables/sets are purged
                # so we define the file to stop it being deleted
                file { '/etc/nftables/sets/requestctl.nft':
                    ensure => file,
                }

                nftables::file::input { 'drop-blocked-nets':
                    order   => 5,
                    content => 'ip saddr $BLOCKED_NETS drop'
                }
            }

            prometheus::node_textfile { 'check-nft':
                filesource => 'puppet:///modules/profile/firewall/check_nftables.py',
                interval   => '*:0/30',
                run_cmd    => '/usr/local/bin/check-nft',
            }
        }

        default: { fail("unknown provider: ${provider}") }
    }
}